How QVault security works
Security is default. QVault reduces theft and adapts.
Encrypted before disk
Files are encrypted before storage — unreadable by default.
AES-256-GCM
Encryption protects data and detects tampering.
Per-file keys
Each file has a unique key — small risk, easy upgrades.
Crypto-agile design
Security evolves without breaking your workflow.
Files are encrypted before storage
Encryption happens before a file ever touches disk. The server filesystem is designed to contain encrypted blobs — not readable documents.
AES-256-GCM as the foundation
QVault uses AES-256-GCM (AEAD): it encrypts data and authenticates it, so unauthorized changes are detected.
Symmetric encryption remains a strong foundation even under realistic quantum considerations. The key is to pair it with design choices that reduce long-term exposure.
Per-file encryption keys
Each file is protected by a unique, randomly generated key. That means the system is designed to avoid a single “global key” becoming a single point of failure.
Quantum-Safe Mode (Q-Safe)
Q-Safe Mode doesn’t “replace cryptography”. It’s an additional layer that raises the cost of attack and targets “harvest now, decrypt later” strategies.
Crypto-agility by design
Encryption is not static. QVault is built to evolve security layers over time — so you can harden protection without re-uploading everything or breaking the product.
Security is a process
The goal is simple: make copied data less valuable, keep keys isolated, and keep the system ready to adapt as standards evolve.